c2c78096de99d7d3c088aaaa8b51db754a2e3ca76b3464498158d94c047da8d5

General

Target
Docusign_Account_Update-Batchfile.bat
Size 10.8MB
Sample260924-2vr5datfpb
SHA256 c2c78096de99d7d3c088aaaa8b51db754a2e3ca76b3464498158d94c047da8d5
MD5 8951771c650faf9e2e9f66cb7e88478c
SHA1 42618f6455c5fde970688e8c6be73e7f953d1a46
SHA512 a8111616c03717cf04709f8a83c3542f7d9c95f79706174dafdaccb40dd02f44dcdfd0e3e0110096191f022fa02fc4bca0319874f5a64529c994f21ed807a3fc
SSDEEP 49152:92lsUEuvgrbdvM7iGQ1pHf1B5WcR9hy02Rtij7BAbOs9ngYwmXgXELOPokWbuXVG:o
TLSH
T187B62338895E3BDE0501A1FAB726B8893DDD23C74C42135783ACC6A131F94B49E67CB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Docusign_Account_Update-Batchfile.bat
- Size 10.8MB
- SHA256 c2c78096de99d7d3c088aaaa8b51db754a2e3ca76b3464498158d94c047da8d5
- MD5 8951771c650faf9e2e9f66cb7e88478c
- SHA1 42618f6455c5fde970688e8c6be73e7f953d1a46
- SHA512 a8111616c03717cf04709f8a83c3542f7d9c95f79706174dafdaccb40dd02f44dcdfd0e3e0110096191f022fa02fc4bca0319874f5a64529c994f21ed807a3fc
- SSDEEP 49152:92lsUEuvgrbdvM7iGQ1pHf1B5WcR9hy02Rtij7BAbOs9ngYwmXgXELOPokWbuXVG:o
- TLSH
  T187B62338895E3BDE0501A1FAB726B8893DDD23C74C42135783ACC6A131F94B49E67CB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware backdoor defense_evasion discovery execution persistence privilege_escalation ransomware rat revoked_codesign spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2